1. Component 9 – Networking and Health Information Exchange Unit 9-1 Privacy, Confidentiality, and Security Issues and Standards This material was developed by Duke University, funded by the Department of Health and Human Services, Office of the National Coordinator for Health Information Technology under Award Number IU24OC000024.

2. 2 Unit 9-1 Objectives Explain the concepts of privacy and confidentiality requirements and policies and learn how to implement the requirements Describe how to secure data storage and transmission using data encryption, signatures, validation, non-repudiation, and integrity (PKI, certificates, and security protocols) Component 9/Unit 9-1Health IT Workforce Curriculum Version 2.0/Spring 2011

3. Security Defined The quality or state of being secure Freedom from danger Freedom from fear or anxiety Measures taken to guard against espionage or sabotage, crime, attack, or escape Component 9/Unit 9-1Health IT Workforce Curriculum Version 2.0/Spring 2011 3

4. Information Security Protecting information and information systems (including computers, computing devices and networks) from:  Unauthorized access  Unauthorized use  Unauthorized alterations  Unauthorized interruptions  Devastation Component 9/Unit 9-1Health IT Workforce Curriculum Version 2.0/Spring 2011 4

5. Key Security Concepts Confidentiality Integrity Availability Accountability Nonrepudiation Component 9/Unit 9-1Health IT Workforce Curriculum Version 2.0/Spring 2011 5

6. Confidentiality Confidentiality is making sure that only authorized individuals have access to information. It is also making sure that individuals with access keep the information private and do not share with others. There are Federal and State laws in place to protect patient confidentiality, and punish those who abuse confidentiality. Component 9/Unit 9-1Health IT Workforce Curriculum Version 2.0/Spring 2011 6

7. The Health Insurance Portability and Accountability Act (HIPPA) Protects health insurance coverage for workers and their families when they change or lose their jobs. Requires the establishment of national standards for electronic health care transactions and national identifiers for providers, health insurance plans, and employers. Component 9/Unit 9-1Health IT Workforce Curriculum Version 2.0/Spring 2011 7

8. HIPPA Continued Addresses the security and privacy of health data. Encourages the widespread use of electronic data interchange (EDI) in the U.S. health care system. Component 9/Unit 9-1Health IT Workforce Curriculum Version 2.0/Spring 2011 8

9. Integrity Integrity means that the data in a system is the same as the data from the original source. The data has not been altered or destroyed, intentionally or unintentionally. Component 9/Unit 9-1Health IT Workforce Curriculum Version 2.0/Spring 2011 9

10. Encryption Plaintext + Cipher = Ciphertext Component 9/Unit 9-1Health IT Workforce Curriculum Version 2.0/Spring 2011 10 Hi Tevin, Our meeting today will start at 2 pm. Don’t forget to bring the UNC file so we can go over it. Thanks, Michele Xsdi&9 SJiOih Jiouqn po,I(_f MLPada[p90= )09[;aclk 8cj[09ampoiJ Had98.,mafds af89J Jip235 + =

11. Example Cipher = Shift characters x amount to the y Plaintext = Hospital X= 3, y = right Ciphertext = KRVSLWDO X=4, y=left Ciphertext = DKOLEPWH Component 9/Unit 9-1Health IT Workforce Curriculum Version 2.0/Spring 2011 11

12. Types of Encryption Symmetric –Same key used to encrypt and decrypt –Shared key Asymmetric –One key used to encrypt and another key used to decrypt –Public key encryption Component 9/Unit 9-1Health IT Workforce Curriculum Version 2.0/Spring 2011 12

13. Hashes A number that is generated based on the data. If the data has been altered in any way then the hash will be different. Also called a message digest or simply a digest. Component 9/Unit 9-1Health IT Workforce Curriculum Version 2.0/Spring 2011 13

14. Availability Means that the system/data is available when needed Fault-tolerance Denial of service (DoS) Component 9/Unit 9-1Health IT Workforce Curriculum Version 2.0/Spring 2011 14

15. Accountability Accountability is the process of holding a person/entity responsible for his actions. System must Identify users Maintain audit trail of actions Component 9/Unit 9-1Health IT Workforce Curriculum Version 2.0/Spring 2011 15

16. Nonrepudiation Provides Proof –Origin Digital signatures Private keys (asymmetric encryption) –Delivery Return receipts Component 9/Unit 9-1Health IT Workforce Curriculum Version 2.0/Spring 2011 16

17. Public Key Infrastructure (PKI) Certificates –Also called digital or identity certificates –Public keys Certificate Authority (CA) Registration Authority (RA) Revocation –Certificate Revocation List (CRL) Component 9/Unit 9-1Health IT Workforce Curriculum Version 2.0/Spring 2011 17

18. Component 9/Unit 9-1Health IT Workforce Curriculum Version 2.0/Spring 2011 18

19. Component 9/Unit 9-1Health IT Workforce Curriculum Version 2.0/Spring 2011 19